topic Re: help in a regular expression extraction in Splunk Search

help in a regular expression extraction

royimad — Tue, 20 Aug 2013 16:23:15 GMT

I have a text that contains anything followed by a word that start with either
XPOS, POS and HF and ended by -

Example:
ABC XPOS2024 -
DEF POS340903 -
GHI HF3948329 -
...

How to extract XPOS2024 , POS340903 , HF3948329 using regular expression?

yannK — Tue, 20 Aug 2013 17:00:28 GMT

try this on the search : (and remove the underscored, they are here to trick the html formatting)

* | rex "(?<myfield>(XPOS|POS|HF)\d+)" | table myfield

royimad — Wed, 21 Aug 2013 10:20:07 GMT

Error in 'rex' command: Encountered the following error while compiling the regex '?(XPOS|POS|HF)\d+)': Regex: nothing to repeat

royimad — Wed, 21 Aug 2013 10:20:29 GMT

I'm receiving this error

royimad — Wed, 21 Aug 2013 10:20:52 GMT

it seems that this isn't working

Ayn — Wed, 21 Aug 2013 10:25:06 GMT

* | rex "(?<myfield>(XPOS|POS|HF)\d+)" | table myfield

dishasaxena — Wed, 21 Aug 2013 10:55:05 GMT

You may try below regex as well:
"(?:)[^ ]+ +(?P(XPOS|POS|HF)[^ ]+) +-"

If it does not work please let me know.

Regards,
Disha

yannK — Wed, 21 Aug 2013 16:42:19 GMT

Thanks Åynm I had a missing parenthesis.

And if the characters after are not always digits, disha's regex is perfect.

royimad — Wed, 21 Aug 2013 20:54:34 GMT

It's working great thank you guys

royimad — Wed, 21 Aug 2013 20:54:45 GMT

Thanks man